Can permissions on the Local System account be changed?

  • Thread starter Thread starter johnwilliams_esquire
  • Start date Start date
J

johnwilliams_esquire

Can permissions on the Local System account be changed or removed etc.
If so, how?

Or are the permissions fixed and cannot be changed?

Thanks.
 
Can permissions on the Local System account be changed or removed etc.
If so, how?

Or are the permissions fixed and cannot be changed?

Thanks.
Click to expand...

You haven't given us enough information to get a specific answer. Is
this a standalone machine or on a workstation connected to a domain?
What version of XP and what service pack level? Are you the domain
administrator?

Malke
 
Malke said:
You haven't given us enough information to get a specific answer. Is
this a standalone machine or on a workstation connected to a domain?
What version of XP and what service pack level? Are you the domain
administrator?
Click to expand...

It's for XP Professional SP2. FWIW I'd like to know the answer in the
case of a standalone m/c and a box connected to a domain (and whether
or not I'm the domain administrator). Thanks for distinguishing those
scenarios.
 
J said:
It's for XP Professional SP2. FWIW I'd like to know the answer in the
case of a standalone m/c and a box connected to a domain (and whether
or not I'm the domain administrator). Thanks for distinguishing those
scenarios.
Click to expand...

Well, of course you can change permissions. If you have a standalone
machine running XP Pro (as you do), you can set very fine-grained
permissions by using the Group Policy Editor.

Start>Run>gpedit.msc [enter]

You need to be logged in with an account with administrative privileges.
If you want to know more about the Group Policy Editor, then type that
into XP's Help & Support. Be careful working with the Group Policy
Editor; it is completely possible to lock yourself out! There is also a
newsgroup for the Group Policy Editor if you have specific questions
about it:

microsoft.public.windows.group_policy

If you have a workstation joined to a domain, permissions are usually
set at the domain level and although there may be a local administrator
for emergencies, normally regular users would not be able to log in as
local administrator or set/change permissions on the domain
workstation. One of the reasons for running a domain is to have central
control of the workstations.

If you want to know more about domain set up and best practices, this is
a vast subject. I suggest starting with TechNet, which is a marvelous
resource:

http://technet.microsoft.com/default.aspx

Malke
 
As Malke noted, its is entirely possible to lock yourself out of critical functions with the Group Policy Editor, on a stand alone machine. On a stand alone computer, policies put in place using the Group Policy Editor apply to all users of the machine.

You need to provide more information about what you're trying to accomplish, or what permissions/capabililties you are trying to give/remove from the Local System account.

--
Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display\Security
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Per user Group Policy Restrictions for XP Home and XP Pro
http://www.dougknox.com/xp/utils/xp_securityconsole.htm
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

Malke said:
J said:
It's for XP Professional SP2. FWIW I'd like to know the answer in the
case of a standalone m/c and a box connected to a domain (and whether
or not I'm the domain administrator). Thanks for distinguishing those
scenarios.
Click to expand...

Well, of course you can change permissions. If you have a standalone
machine running XP Pro (as you do), you can set very fine-grained
permissions by using the Group Policy Editor.

Start>Run>gpedit.msc [enter]

You need to be logged in with an account with administrative privileges.
If you want to know more about the Group Policy Editor, then type that
into XP's Help & Support. Be careful working with the Group Policy
Editor; it is completely possible to lock yourself out! There is also a
newsgroup for the Group Policy Editor if you have specific questions
about it:

microsoft.public.windows.group_policy

If you have a workstation joined to a domain, permissions are usually
set at the domain level and although there may be a local administrator
for emergencies, normally regular users would not be able to log in as
local administrator or set/change permissions on the domain
workstation. One of the reasons for running a domain is to have central
control of the workstations.

If you want to know more about domain set up and best practices, this is
a vast subject. I suggest starting with TechNet, which is a marvelous
resource:

http://technet.microsoft.com/default.aspx

Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User
Click to expand...
 
Back
Top